Thanks to Jim for figuring out how to reproduce the problem, I was
able to apply pr94044-jig.diff to poorly hash the specialization
table. (That places all the specializations of a particular template
in the same bucket, forcing us to compare the arguments.)
The testcase creates sizeof_exprs containing argument packs, and we
can no longer use same_type_p on those.